VulnHub

A significant crypto heist has taken place, resulting in a loss of approximately $290 million from Kelp DAO. The attack is attributed to North Korean hackers who exploited vulnerabilities in LayerZero’s DVN by compromising specific Remote Procedure Calls (RPCs) and launching Distributed Denial of Service (DDoS) attacks on others. This strategy forced the system to switch over to compromised infrastructure, allowing the attackers to siphon off funds. This incident raises alarms within the cryptocurrency community, highlighting the ongoing threat posed by state-sponsored hackers and the need for enhanced security measures in decentralized finance. As crypto continues to grow, incidents like this can undermine user trust and have broader implications for the market.

Bluesky, a decentralized microblogging platform, was hit by a 24-hour Distributed Denial of Service (DDoS) attack that began on April 15. The attack led to significant service disruptions, impacting users who rely on the platform for communication and information sharing. A pro-Iran hacker group has claimed responsibility for this attack, indicating a possible politically motivated cyber incident. DDoS attacks can overwhelm a service with traffic, rendering it unavailable to legitimate users, which raises concerns about the platform's security and its ability to handle such threats in the future. This incident serves as a reminder of the ongoing risks facing online platforms, especially those involved in social discourse.

Bluesky, a social media platform, was hit by a significant distributed denial-of-service (DDoS) attack that lasted around 24 hours. A pro-Iran hacker group has claimed responsibility for this disruption. Users experienced difficulties accessing the platform during the attack, impacting their ability to communicate and interact online. This incident raises concerns about the security of social media platforms and the potential for politically motivated cyberattacks to affect users worldwide. As cyber threats become more sophisticated, it emphasizes the need for companies to bolster their defenses against such attacks.

Researchers from Fortinet FortiGuard Labs and Palo Alto Networks Unit 42 have identified that attackers are exploiting a command injection vulnerability, CVE-2024-3721, in TBK DVRs and outdated TP-Link Wi-Fi routers. This medium-severity flaw, which has a CVSS score of 6.3, allows malicious actors to hijack these devices to create a botnet for DDoS attacks. The compromised TBK DVRs and EoL TP-Link routers are particularly concerning as they can be easily targeted due to their lack of ongoing support and security updates. This situation poses a significant risk to users, as their devices can be turned into tools for larger-scale cyberattacks without their knowledge. Users of these devices should take immediate action to secure their systems against potential exploitation.

In a significant crackdown on online crime, international law enforcement agencies, including the FBI and Europol, launched ‘Operation PowerOff’ to disrupt DDoS-for-hire services. This operation involved seizing critical infrastructure used by these services and making several arrests. Additionally, authorities sent warning letters to individuals known to have used these DDoS services, signaling a strong stance against such illicit activities. DDoS attacks, which overwhelm websites and networks to render them unusable, have been a growing concern for businesses and organizations worldwide. By targeting these services, law enforcement aims to reduce the frequency of these attacks and deter potential users from engaging with them.

On April 13, 2026, law enforcement agencies conducted 'Operation PowerOFF,' which successfully identified 75,000 users involved in distributed denial-of-service (DDoS) attacks across 21 countries. The operation led to the takedown of 53 domains associated with these attacks. By targeting the DDoS ecosystem, authorities aim to disrupt the infrastructure that enables these types of cyberattacks, which can overwhelm websites and online services, causing significant downtime and financial losses. This operation is a crucial step in combating the growing threat of DDoS attacks, which have become increasingly sophisticated and harmful to businesses and individuals alike. The large number of identified users highlights the scale of the issue and underscores the need for ongoing vigilance in cybersecurity efforts.

A report from Qrator Labs has revealed a significant increase in a DDoS botnet, which has now ballooned to 13.5 million compromised devices over the past year. The majority of these devices are located in the United States, Brazil, and India. This surge in botnet size has enabled attackers to launch unprecedented distributed denial-of-service attacks, reaching up to 2 terabits per second. The fintech and betting industries appear to be the primary targets of these assaults. This situation raises alarms for businesses in these sectors, as the sheer scale of attacks could disrupt services and lead to substantial financial losses.

A recent report from Qrator Labs indicates that the largest known DDoS botnet has expanded to encompass 13.5 million devices. This massive botnet is capable of launching Distributed Denial of Service (DDoS) attacks reaching up to 2 terabits per second. The primary target of these attacks has been the financial technology sector, raising concerns for companies in that space. With such a vast number of devices potentially under the control of attackers, the threat to both service availability and data security is significant. Companies in the FinTech sector, as well as other industries relying on online services, need to bolster their defenses to mitigate the risks associated with these powerful DDoS attacks.

The Masjesu botnet, also referred to as XorBot, has emerged as a stealthy DDoS-for-hire service that primarily targets Internet of Things (IoT) devices. Unlike many other botnets, Masjesu avoids high-profile targets, such as Department of Defense IP addresses, opting instead for less conspicuous victims. This botnet employs XOR encryption to maintain low visibility and ensure its persistence within compromised systems. As the use of IoT devices continues to rise, the potential for such botnets to disrupt services and cause damage increases, making it crucial for users and organizations to secure their devices against such threats. The activity of Masjesu raises concerns about the growing sophistication of DDoS services that are accessible for hire, which can have widespread implications for network stability and security.